4 ms·

Due your due diligence. Get third-party validation from someone with a good reputation you can trade on. Proudly flaunt that validation on your website, marketi

by dlgeek 9y ago

Due your due diligence. Get third-party validation from someone with a good reputation you can trade on. Proudly flaunt that validation on your website, marketing material, etc., rather than hiding it behind some NDA for big customers only.

jlgaddis 9y ago
I know that some people feel that it isn't worth the paper it's printed on but I looked for FIPS 140-2 validated devices when I was looking for smart cards (for storing the private keys of CAs in an internal PKI). I'm not aware of any U2F keys that have been FIPS-validated (I realize that it is a very expensive and long process), though. Yubico's web site [0] says that validation is in process (for some of their devices) but it has said that for as long as I can remember. I like and recommend the Yubikeys as well (not that my opinion is worth anything) and, other than that one "PIN bypass" issue in the OpenPGP applet on some NEOs [1] (which was inherited from upstream), I don't recall hearing of any issues with them. There may be better devices out there but I'm sure there are much worse ones that you could buy (as AGL just showed us) and I'm quite happy with my (~7!) Yubikeys. ETA: "The YubiKey ... meets the highest level of assurance (LOA) requirements, based on NIST Electronic Authentication Guideline SP 800-63-2 ..." [2]. [0]: https://www.yubico.com/products/yubikey-hardware/compare-yubikeys/ https://www.yubico.com/products/yubikey-hardware/compare-yub... [1]: https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory... [2]: https://www.yubico.com/wp-content/uploads/2016/06/Yubico_WhitePaper_Achieving_LOA3and4_with_YubiKeys.pdf https://www.yubico.com/wp-content/uploads/2016/06/Yubico_Whi...
- dsl 9y ago
  I'd recommend watching this [1] talk once the videos go online. It paints a pretty nasty picture of all the things you can screw up and still end up FIPS validated. 1. https://www.blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443 https://www.blackhat.com/us-17/briefings/schedule/index.html...
  - jlgaddis 9y ago
    Oh, I'm well aware that FIPS -- or any other certification program, actually -- isn't a panacea. There were issues found with the RNG in some country's national ID cards (smart cards) as well; the RNG had also achieved FIPS 140-2 validation. All things being equal, though, I would still be inclined to have a little more trust in something that has been through the process than I would in, say, the homebrew RNG [0?] used by Honest Achmed's Used Cars and Certificates. [0]: https://xkcd.com/221/ https://xkcd.com/221/
    - deleted 9y ago
      [deleted]
    - jlgaddis 9y ago
      > Honest Achmed's FYI, I was making a reference to a "bug" from 6.5 years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959 (another HN'er thought this was a "little racist")
      - Xylakant 9y ago
        FWIW: I'm absolutely certainly guilty of the same mistake, but referencing a racist stereotype that somebody else (jokingly) used doesn't make it not racist (1). It's easy to fall into the trap and me, too, considered Honest Achmed a good joke at the time, but I don't, any more. (the joke is still good, but the names picked are not) (1) unless you use the reference to put it into context, or discuss it, ...
        jlgaddis 9y ago
        TBQH, I really don't care if anyone thought it was racist or was offended by it or whatever. They're completely missing the point -- and "Honest Achmed" wasn't even a key part of that sentence anyways. It could've been Honest Achmed, Honest José, or, hell, even Honest Abe, but I suddenly remembered that ticket and so I replaced "some fly-by-night crypto startup" (or whatever I had originally written) with that. I'm over all the politically correct bullshit and people actively looking for things to be offended by. It wasn't meant to be racist. It was meant to illustrate a point. I come to HN to get away from all of that shit so, please, go be offended by something else.
tptacek 9y ago
Validation in this space is nosebleed expensive. The "usual suspect" security assessment firms don't do this kind of work (or have no business doing it).

by dlgeek 9y ago

jlgaddis 9y ago

I know that some people feel that it isn't worth the paper it's printed on but I looked for FIPS 140-2 validated devices when I was looking for smart cards (for storing the private keys of CAs in an internal PKI). I'm not aware of any U2F keys that have been FIPS-validated (I realize that it is a very expensive and long process), though. Yubico's web site [0] says that validation is in process (for some of their devices) but it has said that for as long as I can remember. I like and recommend the Yubikeys as well (not that my opinion is worth anything) and, other than that one "PIN bypass" issue in the OpenPGP applet on some NEOs [1] (which was inherited from upstream), I don't recall hearing of any issues with them. There may be better devices out there but I'm sure there are much worse ones that you could buy (as AGL just showed us) and I'm quite happy with my (~7!) Yubikeys. ETA: "The YubiKey ... meets the highest level of assurance (LOA) requirements, based on NIST Electronic Authentication Guideline SP 800-63-2 ..." [2]. [0]: https://www.yubico.com/products/yubikey-hardware/compare-yubikeys/ https://www.yubico.com/products/yubikey-hardware/compare-yub... [1]: https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory... [2]: https://www.yubico.com/wp-content/uploads/2016/06/Yubico_WhitePaper_Achieving_LOA3and4_with_YubiKeys.pdf https://www.yubico.com/wp-content/uploads/2016/06/Yubico_Whi...

dsl 9y ago
I'd recommend watching this [1] talk once the videos go online. It paints a pretty nasty picture of all the things you can screw up and still end up FIPS validated. 1. https://www.blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443 https://www.blackhat.com/us-17/briefings/schedule/index.html...
- jlgaddis 9y ago
  Oh, I'm well aware that FIPS -- or any other certification program, actually -- isn't a panacea. There were issues found with the RNG in some country's national ID cards (smart cards) as well; the RNG had also achieved FIPS 140-2 validation. All things being equal, though, I would still be inclined to have a little more trust in something that has been through the process than I would in, say, the homebrew RNG [0?] used by Honest Achmed's Used Cars and Certificates. [0]: https://xkcd.com/221/ https://xkcd.com/221/
  - deleted 9y ago
    [deleted]
  - jlgaddis 9y ago
    > Honest Achmed's FYI, I was making a reference to a "bug" from 6.5 years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959 (another HN'er thought this was a "little racist")
    - Xylakant 9y ago
      FWIW: I'm absolutely certainly guilty of the same mistake, but referencing a racist stereotype that somebody else (jokingly) used doesn't make it not racist (1). It's easy to fall into the trap and me, too, considered Honest Achmed a good joke at the time, but I don't, any more. (the joke is still good, but the names picked are not) (1) unless you use the reference to put it into context, or discuss it, ...
      - jlgaddis 9y ago
        TBQH, I really don't care if anyone thought it was racist or was offended by it or whatever. They're completely missing the point -- and "Honest Achmed" wasn't even a key part of that sentence anyways. It could've been Honest Achmed, Honest José, or, hell, even Honest Abe, but I suddenly remembered that ticket and so I replaced "some fly-by-night crypto startup" (or whatever I had originally written) with that. I'm over all the politically correct bullshit and people actively looking for things to be offended by. It wasn't meant to be racist. It was meant to illustrate a point. I come to HN to get away from all of that shit so, please, go be offended by something else.

tptacek 9y ago

Validation in this space is nosebleed expensive. The "usual suspect" security assessment firms don't do this kind of work (or have no business doing it).